News

Another Zero-Day Java Flaw Discovered

For the second time in less than a month, researchers have discovered a "critical" zero-day issue with Oracle's Java plugin.

Adam Gowdiak, CEO of security firm Security Explorations, discovered the flaw that can be exploited to bypass Java's security sandbox. Once leveraged, malware can be remotely installed on a targeted machine.

"The impact of this issue is critical -- we were able to successfully exploit it and achieve a complete Java security sandbox bypass in the environment of Java SE 5, 6 and 7," wrote Gowdiak in a Full Disclosure security newsletter.

He also commented that anyone running the Java plugin is vulnerable to attack, no matter what OS or Web browser used, and that Oracle needs to move quickly to fix the situation.

"We hope that a news about one billion users of Oracle Java SE software [3] being vulnerable to yet another security flaw is not gonna spoil the taste of Larry Ellison's [4] morning...Java," wrote Gowdiak.

Gowdiak's security team tested the vulnerability and was able to leverage the flaw it on both Windows- and Mac-based machines. Exploitation was also successful using Firefox 15.0, Google Chrome 21.0, Internet Explorer 9, Opera 12.02 and Safari 5.1 Web browsers.   

Specific details on the vulnerability have been forwarded to Oracle by the security team.

The Security Explorations team was also responsible for finding a flaw in Java Version 7 Update 7 earlier this month. The vulnerability, which was found one day after the release of the out-of-band update, also could be leveraged by bypassing the security features in Java's security sandbox. Gowdiak also said that he had reported 30 vulnerabilities earlier that year to Java -- with many still unfixed.

Oracle has remained quiet on the disclosure of the new vulnerability, and it is unclear whether a fix will come in the form of an out-of-band patch or be part of Oracle's quarterly Java update, scheduled for Oct. 16.

About the Author

Chris Paoli is the site producer for Redmondmag.com and MCPmag.com.

Featured

  • Windows Admin Center vs. Hyper-V Manager: What's Better for Managing VMs?

    Microsoft's preferred interface for Windows Server is Windows Admin Center, but can it really replace Hyper-V Manager for managing virtual machines? Brien compares the two management tools.

  • Microsoft Offers More Help on Windows Server 2008 Upgrades

    Microsoft this week published additional help resources for organizations stuck on Windows Server 2008, which fell out of support on Jan. 14.

  • Microsoft Ups Its Carbon Reduction Goals

    Microsoft on Thursday announced a corporatewide carbon reduction effort that aims to make the company "carbon negative" by 2030.

  • How To Dynamically Lock Down an Unattended Windows 10 PC

    One of the biggest security risks in any organization happens when a user walks away from their PC without logging out. Microsoft has the solution (and it's not a password-protected screensaver).

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.